Beanstalk Part 1

Summary

As indicated in the Solidity docs: "The low-level functions call, delegatecall and staticcall return true as their first return value if the account called is non-existent, as part of the design of the EVM. Account existence must be checked prior to calling if needed." Therefore, transfers may fail silently.

Vulnerability Details

In the UnwrapAndSendETH::unwrapAndSendETH, a call is executed with the following code:

Impact

Per the Solidity docs:
"The low-level functions call, delegatecall and staticcall return true as their first return value if the account called is non-existent, as part of the design of the EVM. Account existence must be checked prior to calling if needed." Therefore, transfers may fail silently.
Please find the documentation here: https://docs.soliditylang.org/en/develop/control-structures.html#error-handling-assert-require-revert-and-exception

Tools Used

Manual review

Recommendations

Check for the account's existence prior to transferring.